Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitLeaks – Search engine for exposed secrets on GitHub

gitleaks.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: GitLeaks – Search engine for exposed secrets on GitHub

#51

Post by quickben »

mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

Of course, that's because you did something morally wrong.

This is different than what people label as 'echo chamber'. In there you'd have either 100% love or hate.

Having mixed responses verging toward hate, says you screwed up and the general public doesn't approve of it.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#52

Post by LyndsySimon »

flipp3r wrote: post #4

I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…

I strongly disagree with this reasoning.

Yes, more people will burned by making these data more easily available to the public - but as a result of those people being burned, security for the community as a whole will be improved over time.

An example of this is what happened with Facebook. Prior to 2013, most users logged in to Facebook without using HTTPS. A Firefox-based tool was released that sniffed for Facebook traffic over WiFi and snagged the other users' cookie to allow for easy session hijacking (Firesheep). Shortly after Firesheep started getting press coverage Facebook enabled HTTPS-by-default[1].

I think it's perfectly valid to argue whether or not the short-term harm caused by this sort of thing is justified by the longer-term benefit, but I don't think it's quite fair to say that the only reason to offer it is to enable abuse.

[1]: https://www.facebook.com/notes/facebook-engineering/secure-b...

Re: GitLeaks – Search engine for exposed secrets on GitHub

#53

Post by LyndsySimon »

mostafaberg wrote: post #42

I don't think it's illegal or wrong to have that search, those mistakes are made by developers who aren't paying attention to security, and from experience those leaks will never be resolved UNTIL they get widely exposed, until then, lots of those people will just shrug it off.. you're actually doing a favour to the users who depend on those developers, you never know when the next leak will be and it might be stoppe…

'tis better to be pwned and found out than to never realize that you've been pwned at all.

- Shakespeare or something

Re: GitLeaks – Search engine for exposed secrets on GitHub

#54

Post by kiallmacinnes »

flipp3r wrote: post #27
kiallmacinnes wrote: post #23

Earlier quoted context omitted.

There are non-abusive uses of this kind of data, e.g. security researchers, or IT departments outsourcing credential leak scanning, etc.. Also, notifying via a GitHub issue is, in my opinion, a terrible idea. GitHub has no concept of a security issue viewable only to the repo maintainers, so filing a public issue might make things worse (by calling public attention to it). A paid search engine without any notificatio…

Their FAQ indicates they update the index every two months, but no information on what they do with the data in the meantime. Ideally this scanner would be a feature of a Github or a Bitbucket or a Gitlab, etc, itself. They could've decided to contact them to add this as a feature, or decided to contact repository owners, but instead they decided to sell the data publicly. Real shame.

I do remember reading something about GitHub preventing some keys from being pushed (AWS secrets etc?) But it's a vague memory from a long time ago!

Re: GitLeaks – Search engine for exposed secrets on GitHub

#55

Post by daenney »

quickben wrote: post #51
mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

Of course, that's because you did something morally wrong. This is different than what people label as 'echo chamber'. In there you'd have either 100% love or hate. Having mixed responses verging toward hate, says you screwed up and the general public doesn't approve of it.

They didn't do anything morally wrong. The data is already public and easily searchable with a few regex tricks. They just made it a tiny bit more convenient but anyone that's thought of this as a source of credentials can easily scrape it themselves.

If anything what they're doing might help shine a light on how big of an issue this actually is and provide a helpful corpus of data to train algorithms on to detect this better.

The issue at this point is far too big to be able to go around and notify everyone about this. There's also plenty of repositories that are abandoned or maintainers that are MIA so you'll never be able to properly resolve all of it.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#56

Post by himot »

flipp3r wrote: post #4

I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…

Lol wrong way of marketing own business. Purely nonsense :/ Everyone knows there are secrets on Github.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#57

Post by quickben »

daenney wrote: post #55
quickben wrote: post #51

Earlier quoted context omitted.

Of course, that's because you did something morally wrong. This is different than what people label as 'echo chamber'. In there you'd have either 100% love or hate. Having mixed responses verging toward hate, says you screwed up and the general public doesn't approve of it.

They didn't do anything morally wrong. The data is already public and easily searchable with a few regex tricks. They just made it a tiny bit more convenient but anyone that's thought of this as a source of credentials can easily scrape it themselves. If anything what they're doing might help shine a light on how big of an issue this actually is and provide a helpful corpus of data to train algorithms on to detect th…

Morality depends on current life views, upbringing, societal norms etc. You may disagree and that is fully in your right.

However, account for the fact that not all HN readers are from US. In other countries what they did is in some case against the law (promoting/enabling criminal behaviour and activities/etc).

Re: GitLeaks – Search engine for exposed secrets on GitHub

#58

Post by daenney »

quickben wrote: post #57
daenney wrote: post #55

Earlier quoted context omitted.

They didn't do anything morally wrong. The data is already public and easily searchable with a few regex tricks. They just made it a tiny bit more convenient but anyone that's thought of this as a source of credentials can easily scrape it themselves. If anything what they're doing might help shine a light on how big of an issue this actually is and provide a helpful corpus of data to train algorithms on to detect th…

Morality depends on current life views, upbringing, societal norms etc. You may disagree and that is fully in your right. However, account for the fact that not all HN readers are from US. In other countries what they did is in some case against the law (promoting/enabling criminal behaviour and activities/etc).

I'm not from the US so that's already accounted for.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#59

Post by cookiecaper »

quickben wrote: post #51
mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

Of course, that's because you did something morally wrong. This is different than what people label as 'echo chamber'. In there you'd have either 100% love or hate. Having mixed responses verging toward hate, says you screwed up and the general public doesn't approve of it.

This is part of the disclosure debate that's been going on in the security industry for decades now. Some people take an aggressive full-disclosure stance and believe every flaw should be publicized immediately and some take a non-disclosure stance and say flaws should never be published until they've become entirely irrelevant.

Most have come to the middle and settled on a "responsible disclosure" paradigm, where researchers notify the maintainers and work with them to set a reasonable timeline for the correction of the issue. The issue is publicly disclosed somewhere between 30-90 days after the private disclosure to maintainers; this gives them time to correct the issue and push out updates, and it also incentivizes them to fix the issue instead of sitting on it forever and allowing it to be exploited as a zero-day.

It would've been good to see this paradigm applied here; the search could've sent a message to the repository owner with a note that the result would become public in 60 days, and to ensure all keys had been rotated and that secrets were no longer stored in git after that point.

In any case, none of these people are operating from a morally dubious perspective. I would suggest you refrain from impugning their motives. Virtually everyone in the security community has the end goal of promoting secure software. Aggressive full disclosure advocates believe that their methods will work most effectively not only at getting issues that exist fixed ASAP, but also at ensuring companies adopt strong and safe practices moving forward, since there won't be second chances.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#60

Post by wfn »

mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

Folks who actually exploit GitHub secrets have scrapers hooked onto GH API (so that if you notice you just pushed a password, quickly reverting it won't help you). IMHO you should re-enable the search functionality as it will ultimately make the developer community better at what it does.
Post reply on HN